WordPress Core Flaw Under Active Attack Lets Hackers Run Code During Updates, CISA Warns
A high-severity race-condition bug in WordPress Core, tracked as CVE-2026-119977, is now under active exploitation, according to CISA. With more than 12,600 exploit attempts blocked in 24 hours, the flaw gives attackers a way to run code during core upgrades without logging in.
A serious vulnerability in the core software that powers WordPress sites is being actively exploited, raising the risk that unpatched sites could be quietly taken over.
The bug, registered as CVE-2026-119977, affects WordPress Core and involves a race condition. According to technical reporting cited by U.S. Cybersecurity and Infrastructure Security Agency (CISA), this timing flaw can let unauthenticated attackers execute arbitrary code while WordPress is performing a core upgrade.
Because the exploit targets the upgrade process itself, an attacker who hits the right moment doesn’t need a valid account or password to run their own code on the server. In practice, that can give them control over the site.
CISA has confirmed that attackers are already going after this weakness. More than 12,600 exploit attempts were blocked in a single 24-hour window, indicating broad scanning and probing for vulnerable sites.
WordPress underpins a large share of public websites, from small blogs to business pages and local institutions. A flaw in its core code can therefore expose many organizations at once, including those that rely on their sites for routine communication with customers or citizens.
If attackers successfully exploit CVE-2026-119977, they can alter site content, steal data submitted through web forms, redirect visitors to malicious pages, or use the compromised server as part of wider hacking campaigns. Because the attack happens during what should be a routine security practice — upgrading software — it risks undermining confidence in basic maintenance steps.
For operators of news, e‑commerce, and public-service sites built on WordPress, this translates into immediate operational and reputational risk. A short-lived compromise can still expose payment details or publish misleading information, and it can trigger longer-term trust and regulatory issues once discovered.
From a broader cyber defense perspective, the activity around CVE-2026-119977 fits a pattern in which criminals and state-linked actors move quickly against widely used software components. They don’t have to breach heavily defended networks if they can compromise the shared platforms that sit in front of them.
Key indicators to watch now include any new guidance or emergency measures from major hosting providers, updates or patches from the WordPress project itself, and whether this vulnerability is formally added to CISA’s Known Exploited Vulnerabilities list. A rise in reported WordPress defacements or coordinated campaigns abusing hacked sites would show that the current wave of probing has turned into broad compromise.
Sources
- OSINT